From: Ian Abbott <abbotti@mev.co.uk>
Date: Mon, 12 Nov 2007 12:16:26 +0000 (+0000)
Subject: For AI INSN_READ, check for out-of-range differential channel - only the
X-Git-Tag: v0_7_76~71
X-Git-Url: http://git.tremily.us/?a=commitdiff_plain;h=45b12e71ef3b6d4d7771d6c76e314bb9e23122c6;p=comedi.git

For AI INSN_READ, check for out-of-range differential channel - only the
first half of the channel numbers can be used if analog ref is AREF_DIFF.
---

diff --git a/comedi/drivers/amplc_pci230.c b/comedi/drivers/amplc_pci230.c
index 52a8fb47..93da977f 100644
--- a/comedi/drivers/amplc_pci230.c
+++ b/comedi/drivers/amplc_pci230.c
@@ -677,6 +677,12 @@ static int pci230_ai_rinsn(comedi_device * dev, comedi_subdevice * s,
 	devpriv->ai_bipolar = !PCI230_TEST_BIT(range, 2);
 	if (aref == AREF_DIFF) {
 		/* Differential. */
+		if (chan >= s->n_chan / 2) {
+			DPRINTK("comedi%d: amplc_pci230: ai_rinsn: "
+				"differential channel number out of range "
+				"0 to %u\n", dev->minor, (s->n_chan / 2) - 1);
+			return -EINVAL;
+		}
 		adcen = 3 << 2 * chan;
 		adccon |= PCI230_ADC_IM_DIF;
 		if (devpriv->ai_bipolar) {